Cases › security breach › LR-2026-0626
xAI Grok Build uploaded full Git repositories and history to xAI storage
Confirmed Why: 2 independent outlets · 2 independent reports
Status: no action reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: Test: moderate tier, data of others touched. The sources state data of other users (repositories with customer data and credentials) was taken, but do not state a bounded scope or a count of affected parties, so no higher tier is met.
xAI's Grok Build coding CLI, a coding agent, sent entire Git repositories with full commit history to a Google Cloud Storage bucket run by xAI, beyond the files a task needed. A public researcher testing version 0.2.93 captured the uploads and recovered a planted file the agent had been told not to open. A tracked .env file was also read into the model turn and stored unredacted, though the secrets used in the test were fake. The researcher's teardown established transmission, acceptance and storage, not training. On July 13 the binary stopped making storage requests, and the server returned disable_codebase_upload: true. xAI has not said why full repositories were uploaded by default, how long they were kept, or how many users were affected.
What happened
What was done
No source states an action or fix.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Harness ApplicationSensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs
Similar incidents
Evidence
No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
Not dated in the sources:
- Researcher cereblab captured a repository upload and recovered a planted file the agent had been told not to open.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
Advice to rotate credentials is in the source but not recorded as a remediation because no matching control id clearly applies.
LR-2026-0626 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON